api-docs-weapon
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and downloads tools from well-known registries and CDNs, including @redocly/cli, @openapitools/openapi-generator-cli, and fern-api from npm, as well as the Scalar API reference script from jsdelivr.net. These are established services in the API documentation ecosystem.
- [COMMAND_EXECUTION]: Extensive use of shell commands is documented for documentation building, spec validation, and SDK generation. Tools used include npx, docker, and make. These operations are restricted to the intended purpose of the skill and are triggered by user-initiated tasks.
- [DATA_EXFILTRATION]: Deployment workflows involve network requests to trusted services like GitHub and Bump.sh. These operations use properly scoped API tokens and secrets (e.g., BUMP_TOKEN, NPM_TOKEN, PERSONAL_ACCESS_TOKEN) as per standard development practices.
- [PROMPT_INJECTION]: The skill uses clear instructional language to guide the agent but does not contain patterns attempting to bypass safety filters or override system-level instructions.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted OpenAPI specifications. It mitigates risk by requiring validation steps such as 'redocly lint' before processing data for rendering or SDK generation.
Audit Metadata